Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress

Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress has 47 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 47 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 6 critical and 8 high. 2024 was the busiest year with 18 disclosures.

The most common weakness is Cross-Site Scripting, behind 14 of the records (30%). Other recurring categories include SQL Injection, Missing Authorization.

Every one of the 47 issues recorded for Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress has a vendor fix available, so running the current release closes all known holes.

24 independent researchers contributed these findings, most of them (9) reported by Dmitrii Ignatyev. Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress is installed on roughly 50,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891009.05.2014Today10.08.20156.1Email Subscribers & Newsletters < 2.9.1 - Cross-Site Scripting CVSS 6.1 · 10.08.201524.01.20187.5Email Subscribers & Newsletters <= 3.4.7 - Unauthenticated Subscriber Download CVSS 7.5 · 24.01.201828.05.20186.1Email Subscribers & Newsletters <= 3.4.12 - Cross-Site Scripting CVSS 6.1 · 28.05.201812.07.20196.1Email Subscribers & Newsletters <= 4.1.6 - Cross-Site Scripting CVSS 6.1 · 12.07.201922.07.20199.8Email Subscribers & Newsletters <= 4.1.7 - SQL Injection CVSS 9.8 · 22.07.201913.11.20195.4Email Subscribers & Newsletters <= 4.2.2 - Cross-Site Request Forgery on Settings CVSS 5.4 · 13.11.20198.3Email Subscribers & Newsletters < 4.3.1 - Unauthenticated Blind SQL Injection CVSS 8.3 · 13.11.20196.5Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated Option Creation CVSS 6.5 · 13.11.20195.8Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated File Download w/ Information Disclosure CVSS 5.8 · 13.11.20194.3Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization to Test Email CVSS 4.3 · 13.11.20196.3Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization CVSS 6.3 · 13.11.201913.07.20208.8Icegram Email Subscribers & Newsletters Plugin for WordPress <= 4.5.0 - Cross-Site Request Forgery CVSS 8.8 · 13.07.202016.07.20204.9Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection CVSS 4.9 · 16.07.202009.09.20205.3Email Subscribers & Newsletters <= 4.5.5 - Unauthenticated Email Forgery CVSS 5.3 · 09.09.202011.02.20228.8Email Subscribers & Newsletters <= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection CVSS 8.8 · 11.02.202221.11.20228.8Icegram Express <= 5.4.19 - Authenticated (Subscriber+) SQL Injection CVSS 8.8 · 21.11.202206.02.20236.5Icegram Express <= 5.5.2 - Unauthenticated CSV Injection CVSS 6.5 · 06.02.202311.10.20239.1Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read CVSS 9.1 · 11.10.202326.03.20246.1Email Subscribers & Newsletters <= 5.7.11 - Reflected Cross-Site Scripting via campaign_id CVSS 6.1 · 26.03.202405.04.20245.3Email Subscribers & Newsletters <= 5.7.13 - Missing Authorization CVSS 5.3 · 05.04.20244.4Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import CVSS 4.4 · 05.04.202415.04.20249.8Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection CVSS 9.8 · 15.04.202414.05.20248.8Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request CVSS 8.8 · 14.05.202422.05.20244.3Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization CVSS 4.3 · 22.05.202404.06.20249.8Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash CVSS 9.8 · 04.06.202411.06.20248.8Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] CVSS 8.8 · 11.06.202420.06.20249.8Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin CVSS 9.8 · 20.06.202401.07.20249.8Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe CVSS 9.8 · 01.07.202416.07.20244.3Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization CVSS 4.3 · 16.07.202425.09.20244.3Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure CVSS 4.3 · 25.09.202401.10.20245.4Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVSS 5.4 · 01.10.202416.12.20244.9Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.43 - Authenticated (Admin+) SQL Injection CVSS 4.9 · 16.12.202423.12.20244.4Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings CVSS 4.4 · 23.12.20244.4Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block CVSS 4.4 · 23.12.20244.4Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 23.12.20244.4Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings CVSS 4.4 · 23.12.202427.03.20254.4Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 27.03.202503.04.20254.4Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 03.04.202508.11.20256.6Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection CVSS 6.6 · 08.11.202518.11.20255.3Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger CVSS 5.3 · 18.11.202511.12.20255.3Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution CVSS 5.3 · 11.12.202503.03.20266.5Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter CVSS 6.5 · 03.03.202601.07.20264.3Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action CVSS 4.3 · 01.07.202627.08.20267.2Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress <= 5.9.33 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 27.08.202601.09.20264.4Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 01.09.202607.09.20266.5Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field CVSS 6.5 · 07.09.202621.09.20265.3Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization CVSS 5.3 · 21.09.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

47

Get automatic notifications for all Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-6172

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe

Read the full analysis

Vulnerability Records

47 records
2026-09-21 00:00CVE-2026-83555
5.3
Medium
Usama ArshadYes
2026-09-07 00:30CVE-2026-12757
6.5
Medium
Sander HorsmanYes
2026-09-01 00:00CVE-2025-15692
4.4
Medium
Dmitrii IgnatyevYes
2026-08-27 00:00CVE-2026-81290
7.2
High
JiemookYes
2026-07-01 17:17CVE-2026-11592
4.3
Medium
Dmitrii IgnatyevYes
2026-03-03 12:24CVE-2026-1651
6.5
Medium
Chiao-Lin Yu (Steven Meow)Yes
2025-12-11 21:13CVE-2025-12348
5.3
Medium
Adrian LukitaYes
2025-11-18 16:15CVE-2025-12349
5.3
Medium
Adrian LukitaYes
2025-11-08 00:00CVE-2025-66055
6.6
Medium
Ananda DhakalYes
2025-04-03 00:00CVE-2025-0671
4.4
Medium
Dmitrii IgnatyevYes
Showing 1–10 of 47 reports
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress banner
Latestv5.9.40

Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress

Icegram

Author

Icegram

4.6(1,170)
92/100
Last Updated
2026-10-23 (5d ago)
Active Installs
50,000+
Downloads
13,085,066
Requires WP
3.9+
Requires PHP
7.0+
Tested up to
WP 7.1.3
Created
2014-05-09 (13y ago)

Grow your email list, automate blog post notifications, and run high-converting newsletters & WooCommerce email campaigns — 100% inside WordPress with zero monthly subscriber taxes. Email Subscribers & Newsletters by Icegram Express makes email marketing simple, reliable, and fully WordPress-native. Whether you are a blogger sending automatic new post alerts, a small business broadcasting weekly newsletters, or a WooCommerce store recovering abandoned carts, Icegram Express gives you complete control over your audience and deliverability without writing a single line of code. Trusted by 100,000+ businesses and creators (with 1,020+ five-star reviews on WordPress.org), Icegram Express replaces expensive, capped SaaS platforms like Mailchimp and restrictive plugins with an all-in-one, self-hosted email marketing suite inside your WordPress dashboard. Explore Features: Icegram Express Official Page Compare Plans: Icegram Express Pricing (Free & Max) Read the Guides: Icegram Express Knowledge Base & Documentation Why Switch to Email Subscribers & Newsletters by Icegram Express? Most WordPress newsletter plugins either cap your free list at 500–1,000 subscribers, add mandatory branding, or lock basic automated blog post notifications behind paid add-ons. Icegram Express gives you the essentials Free, with no subscriber limits: Unlimited Subscribers & Lists: Collect unlimited contacts and organize unlimited lists in the free version (compared to 500–1,000 subscriber caps on typical SaaS and freemium plugins). Unlimited Email Sends & Broadcasts: Send unlimited newsletters and campaigns with no monthly send quota restrictions from our plugin. 100% Free Automated Post Notifications: Automatically email subscribers when new blog posts go live, filtered by category or custom post type (often locked behind paid add-ons in competing plugins). 3 Visual Email Builders Included: Design campaigns using the Drag & Drop Composer, the Gutenberg Block Email Editor, or the Classic/HTML Editor. 100% Self-Hosted Data Ownership (GDPR Ready): All subscriber and campaign data lives in your WordPress database rather than external third-party SaaS clouds. Total SMTP & Delivery Freedom: Send via any WordPress SMTP plugin, Icegram Mailer, Amazon SES, SendGrid, Mailgun, Postmark, Brevo, or your host. Curious how we stack up head-to-head? Read our in-depth comparisons with The Newsletter Plugin, FluentCRM, Kit (ConvertKit), and MailPoet & Budget Email Tools. What’s New in Recent Releases (v5.8 – v5.9.40) Revamped Dashboard with AI Suggestions & Growth Charts: Navigate campaigns, subscriber growth trends, unsubscribe metrics, and actionable AI insights from a unified, high-speed interface. Gutenberg Block Email Editor + Drag & Drop Composer: Build campaigns using the native WordPress Block Editor, our visual Drag & Drop builder, or raw HTML with saved template galleries. Pause, Resume & Resend Failed Campaigns: Control live dispatches directly from the Reports screen and retry failed deliveries in one click. Microsoft Outlook API & Postmark Message Streams (Max): Connect modern enterprise senders alongside Amazon SES, SendGrid, Mailgun, Brevo, and SparkPost. Campaign Archives Gutenberg Block (Max): Display past newsletter issues on any public WordPress page or post to boost SEO and social proof. One-Click Unsubscribe Compliance: Fully compliant out of the box with Gmail, Yahoo, and GDPR bulk-sender requirements via native List-Unsubscribe headers. Everything You Get 100% Free — Forever (No Trial, No Credit Card) Everything in this section is included in the core plugin with no artificial contact limits or expiring trials: 1. High-Converting Lead Generation & Opt-In Forms – Flexible Form Placements: Embed subscription forms via the Icegram Express Form Gutenberg block, shortcodes, sidebar/footer widgets, inline post forms, or exit-intent/timed popups. – Ready-Made Form Designs: Launch quickly with pre-built form templates, custom titles for popup forms, and one-click form duplication. – GDPR & Privacy Ready: Built-in single or double opt-in workflows, customizable privacy consent checkboxes, and custom post-signup redirect URLs (for thank-you pages or lead magnets). – Frictionless List Building: Unlimited subscriber lists, bulk CSV import/export with custom column mapping, and direct Mailchimp subscriber import. 2. Automated Post Notifications & Broadcast Newsletters – Automatic New Post Notifications: Send instant email alerts to subscribers the moment a new blog post goes live — filtered by post categories or custom post types. – Unlimited Newsletter Broadcasts: Design and send or schedule one-off announcements, seasonal promotions, and editorial updates to any list. – Automated Welcome & Confirmation Emails: Greet new subscribers immediately with personalized onboarding emails and notify admins on every signup. – Dynamic Merge Tags & Personalization: Personalize subjects and body copy with {{FIRSTNAME}}, {{LASTNAME}}, {{EMAIL}}, {{POSTTITLE}}, {{POSTLINK}}, {{POSTIMAGE-URL}}, {{POSTEXCERPT}}, {{POSTCATS}}, and {{POSTAUTHOR}}. 3. Intuitive Email Design & Template Gallery – 3 Ways to Build: Choose between the visual Drag & Drop editor, the Gutenberg Block email editor, or the Classic/HTML editor. – Responsive Pre-Built Templates: Start from mobile-ready Icegram Express email templates for blog digests, product launches, and announcements, plus save your own reusable templates. – Pre-Send Verification: Preview campaigns across desktop and mobile or send instant test emails before scheduling. 4. Complete Delivery Control & Throttling – Bring Your Own Sender: Connect any WordPress SMTP plugin, host mailer, or Icegram Mailer (includes a free sending tier). – Smart Queue & Batch Throttling: Configure hourly sending limits and cron batch sizes to match your web host’s capacity and protect sender reputation. – Real-Time Campaign Analytics: Track sent counts, opens, link clicks, unsubscribes, and subscriber engagement scores per campaign. Icegram Express Max — Advanced Automation, Targeting & Revenue When your store or publication is ready to scale, Icegram Express Max unlocks multi-step automation workflows, deeper WooCommerce revenue recovery, and enterprise deliverability tools: Visual Automation Workflows & Autoresponder Drip Sequences: Trigger multi-step welcome series, educational drip courses, birthday offers, and event-driven follow-ups based on user actions. Automated Post Digests & Smart Scheduling: Batch your blog content into daily, weekly, or monthly digests, and schedule campaigns by subscriber timezone or send-time optimization. WooCommerce Abandoned Cart Recovery & Dynamic Coupons: Automatically follow up on abandoned carts, send next-order discount coupons, trigger order-status workflows, and run win-back campaigns for inactive buyers. Spam Score Checker & Automated List Cleanup: Test campaign spam scores before hitting send, block bot signups with Google reCAPTCHA, handle hard/soft bounces automatically, and auto-prune unengaged contacts. Custom Fields & Advanced Audience Segmentation: Collect custom subscriber attributes and filter broadcasts or sequences by list membership (is in List / is not in List), engagement score, country, or purchase history. Campaign Attachments, Archive Blocks & Bulk Reporting: Add file attachments to campaigns, embed past newsletter archives via Gutenberg block, export detailed campaign analytics to CSV, and track device/email client breakdowns. Team Role Access & Developer REST API: Assign granular plugin permissions by WordPress user role and connect external apps via REST API and webhooks. Built for WooCommerce Email Marketing Running an online store? Icegram Express turns one-time shoppers into repeat buyers directly from WordPress: Capture Buyers at Checkout (Free & Max): Automatically add WooCommerce customers to targeted lists and segment buyers for product promotions. Recover Lost Revenue Automatically (Max): Trigger multi-email abandoned cart recovery sequences with personalized cart contents and dynamic coupon codes. Behavioral Purchase Triggers (Max): Launch automated cross-sells, upsells, and review requests when orders are created, placed on hold, processing, or completed — plus native wishlist triggers for YITH WooCommerce Wishlist. Seamless WordPress Ecosystem Integrations Icegram Express connects natively with the plugins and email delivery services you already run on your WordPress site: eCommerce & Digital Stores: WooCommerce, Easy Digital Downloads (EDD), YITH WooCommerce Wishlist. Form Builders & Lead Capture: Icegram Collect, Icegram Engage, Contact Form 7 (CF7), WPForms, Gravity Forms, Elementor Pro Forms, Ninja Forms, Forminator, Toolset Forms. LMS, Memberships & Events: LearnDash, MemberPress, Paid Memberships Pro, Ultimate Member, WP Event Manager. Email Delivery & Transactional Mailers (SMTP / API): Icegram Mailer, Amazon SES, SendGrid, Mailgun, Postmark (with Message Streams), Brevo (Sendinblue), SparkPost, Pepipost, Microsoft Outlook API, Post SMTP, WP Mail SMTP, and any standard SMTP relay. Page Builders & Editors: Gutenberg Block Editor, Classic Editor, Elementor, Page Builder by SiteOrigin, Divi. Automation & Developer Tools: WordPress REST API, Webhooks, Zapier, Make (Integromat). Native Gutenberg Blocks Icegram Express Form: Embed any subscription form directly inside pages, posts, or block themes. Campaign Archives (Max): Display an archive of past sent newsletters on any frontend page. Why 100,000+ Site Owners Love Icegram Express “Better than Mailchimp – and way cheaper!” – brianharper “Grew my subscriber list by 20% in just a month!” – fedephyto “I’ve been using Icegram Express for a long time and it has made email marketing inside WordPress really simple. Creating subscriber lists, sending newsletters, and setting up post notification emails is easy and beginner-friendly… Emails are sent reliably and everything works smoothly inside WordPress without needing extra tools.” – shikhargoel1990 “Worked where other plugins failed: easy setup and instant results (unlike those big shots!)” – laurendevine “Best plugin for post notifications and Newsletter broadcasting!” – Roopesh Jain “Best customer support I’ve ever experienced – both on free and paid plans.” – chaffeeb Available in 11+ Languages Icegram Express is localization-ready and translated into Czech, Dutch, English (UK), English (US), German, Hungarian, Polish, Russian, Spanish (Mexico), Spanish (Spain), and Spanish (Venezuela). You can also customize or translate any text string using Loco Translate or the WordPress.org translation project. Other Popular Plugins from the Icegram Team Icegram Engage – Popups, welcome bars, slide-ins, opt-ins, and lead generation campaigns for WordPress. Icegram Mailer – Zero-code, high-deliverability email sending service for WordPress and WooCommerce. Icegram Collect – Lead capture, contact forms, and subscription forms with instant Icegram Express sync. Temporary Login Without Password – Create self-expiring magic login links for developers, agencies, and support teams. Smart Manager – Bulk edit and manage WooCommerce products, orders, coupons, and WordPress posts in an Excel-like spreadsheet.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C